decepticon 1.1.0__tar.gz

decepticon-1.1.0/.dockerignore

@@ -0,0 +1,61 @@
+# ── Build artifacts ──────────────────────────────────────────
+**/node_modules
+**/.next
+**/dist
+**/build
+**/*.tsbuildinfo
+
+# ── Version control ──────────────────────────────────────────
+.git
+.gitignore
+.gitattributes
+
+# ── IDE / Editor ─────────────────────────────────────────────
+.vscode
+.idea
+*.swp
+*.swo
+.DS_Store
+
+# ── Environment / secrets ────────────────────────────────────
+.env
+.env.local
+.env.*.local
+clients/web/.env
+clients/web/.env.*
+*.pem
+*.key
+
+# ── Test / coverage ──────────────────────────────────────────
+**/coverage
+**/.pytest_cache
+**/__pycache__
+**/*.pyc
+**/.ruff_cache
+**/.mypy_cache
+
+# ── Agent tooling state ─────────────────────────────────────
+**/.omc
+**/.claude
+.claude-flow
+
+# ── Logs ─────────────────────────────────────────────────────
+**/*.log
+**/npm-debug.log*
+
+# ── Heavy directories not needed by any Dockerfile ──────────
+# (skills/ IS needed by langgraph.Dockerfile — do not exclude)
+reference
+assets
+tests
+workspace
+
+# ── Client package caches ───────────────────────────────────
+clients/web/.next
+
+# ── Private / EE code — MUST NOT ship in OSS images ─────────
+# The ee/ folder is a private SaaS package linked via `make web-ee`.
+# .gitignore already excludes it from git, but Docker build context
+# scans the working tree directly, so we must exclude it here too.
+clients/ee
+clients/ee/

decepticon-1.1.0/.env.example

@@ -0,0 +1,265 @@
+# =============================================================================
+# Decepticon — Environment Variables
+# =============================================================================
+# The installer copies this file to ~/.decepticon/.env
+# Run `decepticon onboard` to (re)configure interactively.
+
+# --- LLM API Keys (configure at least one credential below) ---
+# Each entry corresponds to one AuthMethod. The onboard wizard rewrites
+# the keys you select; unselected keys keep their placeholder values and
+# are ignored at runtime.
+ANTHROPIC_API_KEY=your-anthropic-key-here
+OPENAI_API_KEY=your-openai-key-here
+GEMINI_API_KEY=your-gemini-key-here
+MINIMAX_API_KEY=your-minimax-key-here
+OPENROUTER_API_KEY=your-openrouter-key-here
+NVIDIA_API_KEY=your-nvidia-key-here
+DEEPSEEK_API_KEY=your-deepseek-key-here
+XAI_API_KEY=your-xai-key-here
+MISTRAL_API_KEY=your-mistral-key-here
+
+# --- Cloud Gateways (added in the OpenClaude provider migration) ---
+# All routed through LiteLLM's native provider implementations. The
+# onboard wizard rewrites only the keys you explicitly select; placeholder
+# values are skipped at credentials-resolution time.
+GROQ_API_KEY=your-groq-key-here
+TOGETHER_API_KEY=your-together-key-here
+FIREWORKS_API_KEY=your-fireworks-key-here
+COHERE_API_KEY=your-cohere-key-here
+MOONSHOT_API_KEY=your-moonshot-key-here
+ZAI_API_KEY=your-zai-key-here
+DASHSCOPE_API_KEY=your-dashscope-key-here
+
+# GitHub Models — fine-grained PAT with the 'models' permission scope.
+# Generate at github.com/settings/personal-access-tokens.
+GITHUB_TOKEN=your-github-token-here
+
+# --- AWS Bedrock ---
+# IAM access key + secret + region. The region must have your chosen
+# Anthropic models enabled (us-east-1 / us-west-2 are typical).
+# AWS_ACCESS_KEY_ID=AKIA...
+# AWS_SECRET_ACCESS_KEY=...
+# AWS_REGION=us-east-1
+
+# --- GCP Vertex AI ---
+# Service-account JSON path + project + region. Download a key from
+# IAM & Admin → Service Accounts. Project + location must match where
+# Anthropic / Gemini models are enabled.
+# GOOGLE_APPLICATION_CREDENTIALS=/abs/path/to/service-account.json
+# VERTEXAI_PROJECT=my-gcp-project-id
+# VERTEXAI_LOCATION=us-central1
+
+# --- Azure OpenAI Service ---
+# Deployment endpoint + key + API version. Deployment names default to
+# the model id (gpt-5.5/gpt-5.4/gpt-5-nano); override per role via
+# DECEPTICON_MODEL_<ROLE> if your Azure deployment names differ.
+# AZURE_API_KEY=...
+# AZURE_API_BASE=https://<resource>.openai.azure.com
+# AZURE_API_VERSION=2024-08-01-preview
+
+# --- LM Studio (local OpenAI-compatible) ---
+# LM Studio runs a local OpenAI-compatible server on port 1234.
+# Launch the LM Studio app → Developer tab → Start Server.
+# LMSTUDIO_API_BASE=http://host.docker.internal:1234/v1
+# LMSTUDIO_MODEL=qwen2.5-coder-7b-instruct
+# LMSTUDIO_API_KEY=lm-studio  # accepts any string; sentinel for the shim
+
+# --- llama.cpp (local OpenAI-compatible) ---
+# llama.cpp's `llama-server` exposes an OpenAI-compatible REST API
+# (default http://localhost:8080/v1). Run a GGUF model with:
+#   llama-server -m /path/to/model.gguf --port 8080
+# The route prefix is `llamacpp/` and remaps to LiteLLM's openai-
+# compatible path with LLAMACPP_API_BASE. See issue #151.
+# LLAMACPP_API_BASE=http://host.docker.internal:8080/v1
+# LLAMACPP_MODEL=qwen2.5-coder-7b-instruct-q4_k_m
+# LLAMACPP_API_KEY=llama-cpp  # accepts any string; sentinel for the shim
+
+# --- Custom OpenAI-compatible Endpoint ---
+# Bring-your-own gateway (vLLM, internal LiteLLM, third-party hub, etc.).
+# CUSTOM_OPENAI_API_BASE=https://gateway.example.com/v1
+# CUSTOM_OPENAI_API_KEY=...
+# CUSTOM_OPENAI_MODEL=gpt-4o-mini
+
+# --- Local LLM (Ollama) ---
+# Set both to run Decepticon against a local Ollama model. The
+# launcher's onboard wizard writes these when you pick "Local LLM".
+# OLLAMA_MODEL is any tag you pulled (`ollama pull qwen3-coder:30b`);
+# the proxy registers ollama_chat/<model> at startup, routing through
+# Ollama's /api/chat endpoint so tool calling keeps working.
+#
+# OLLAMA_API_BASE points the LiteLLM container at your Ollama server.
+# The right URL depends on where Ollama runs:
+#   - macOS / Docker Desktop on Windows / Linux Docker:
+#       http://host.docker.internal:11434
+#       (the litellm service has extra_hosts: host.docker.internal:host-gateway)
+#   - WSL2 with Ollama installed on the Windows host:
+#       http://host.docker.internal:11434  (Docker Desktop wires this up)
+#   - WSL2 with Ollama installed inside the WSL distro itself:
+#       http://localhost:11434
+#       (or http://<wsl-ip>:11434 from `ip addr` inside WSL if Docker
+#        runs natively in WSL without Docker Desktop)
+#   - Remote Ollama on another host:
+#       http://<host-or-ip>:11434
+# OLLAMA_API_BASE=http://host.docker.internal:11434
+# OLLAMA_MODEL=qwen3-coder:30b
+
+# --- LiteLLM Proxy ---
+LITELLM_MASTER_KEY=sk-decepticon-master
+LITELLM_SALT_KEY=sk-decepticon-salt-change-me
+
+# --- PostgreSQL ---
+POSTGRES_PASSWORD=decepticon
+
+# --- Neo4j (Attack Chain Graph DB) ---
+# Used when DECEPTICON_KG_BACKEND=neo4j
+NEO4J_PASSWORD=decepticon-graph
+
+# --- Model Profile ---
+# eco  = per-agent tier (production default)
+# max  = every agent on HIGH (high-value targets)
+# test = every agent on LOW (development / CI)
+DECEPTICON_MODEL_PROFILE=eco
+
+# --- Auth Method Priority ---
+# Comma-separated list of AuthMethods, ordered by user preference. The
+# first method supplies primary models for every tier; the rest are
+# fallbacks. Methods whose credential isn't configured (placeholder key
+# or DECEPTICON_AUTH_CLAUDE_CODE=false) are skipped at runtime.
+#
+# Valid methods: anthropic_api, anthropic_oauth, openai_api, openai_oauth,
+#   google_api, google_oauth, minimax_api, deepseek_api, xai_api,
+#   mistral_api, openrouter_api, nvidia_api, copilot_oauth, grok_oauth,
+#   perplexity_oauth, bedrock_api, vertex_api, azure_api, groq_api,
+#   together_api, fireworks_api, cohere_api, moonshot_api, zai_api,
+#   dashscope_api, github_models_api, lmstudio_local, ollama_local,
+#   ollama_cloud, custom_openai_api
+# Empty value → factory walks _DEFAULT_AUTH_PRIORITY in priority order,
+# keeping only methods whose credential is actually configured.
+DECEPTICON_AUTH_PRIORITY=
+
+# --- Claude Code OAuth (subscription) ---
+# Set true to route Anthropic models through the Claude Code OAuth handler
+# (auth/* in LiteLLM) instead of the x-api-key path. Requires a valid
+# ~/.claude/.credentials.json from `claude` CLI auth.
+DECEPTICON_AUTH_CLAUDE_CODE=false
+
+# --- ChatGPT OAuth (subscription) ---
+# Set true to route OpenAI models through the ChatGPT subscription handler
+# (auth/gpt-* in LiteLLM) instead of the API-key path. Requires one of:
+#   - CHATGPT_SESSION_TOKEN below (browser cookie), OR
+#   - CHATGPT_ACCESS_TOKEN env var (pre-extracted Bearer), OR
+#   - ~/.config/chatgpt/tokens.json file
+DECEPTICON_AUTH_CHATGPT=false
+
+# Session token from a signed-in chatgpt.com browser session:
+#   1. Open chatgpt.com and sign in
+#   2. DevTools → Application → Cookies → chatgpt.com
+#   3. Copy the value of `__Secure-next-auth.session-token`
+# The onboard wizard prompts for this when ChatGPT OAuth is selected.
+CHATGPT_SESSION_TOKEN=
+
+# --- Other OAuth subscriptions (set true + provide one credential each) ---
+# All are selectable from the onboard wizard. Each handler walks the same
+# resolution order at runtime: <X>_ACCESS_TOKEN → <X>_SESSION_TOKEN /
+# _SESSION_COOKIES / _REFRESH_TOKEN → ~/.config/<x>/tokens.json.
+
+# Gemini Advanced (Google One AI Premium) — gemini-sub/* models
+# DECEPTICON_AUTH_GEMINI=false
+# GEMINI_SESSION_COOKIES=                # NID + __Secure-1PSID + __Secure-1PSIDTS
+# GEMINI_ACCESS_TOKEN=                   # alternative: pre-extracted Bearer
+
+# SuperGrok (X Premium+) — grok-sub/* models
+# DECEPTICON_AUTH_GROK=false
+# GROK_SESSION_TOKEN=                    # auth_token cookie from grok.com
+# GROK_ACCESS_TOKEN=                     # alternative: pre-extracted Bearer
+
+# GitHub Copilot Pro — copilot/* models
+# DECEPTICON_AUTH_COPILOT=false
+# COPILOT_REFRESH_TOKEN=                 # ghu_... or ghr_... refresh token
+# COPILOT_ACCESS_TOKEN=                  # alternative: pre-extracted Bearer
+
+# Perplexity Pro — pplx-sub/* models
+# DECEPTICON_AUTH_PERPLEXITY=false
+# PERPLEXITY_SESSION_TOKEN=              # next-auth.session-token cookie
+# PERPLEXITY_ACCESS_TOKEN=               # alternative: pre-extracted Bearer
+
+# --- Benchmark Mode ---
+# Set to 1 to switch the LangGraph orchestrator into BENCHMARK MODE for the
+# XBOW / CTF benchmark harness. Activates Rule-8/9 suspension and accepts
+# challenge context (target_url, vulnerability tags, flag format, mission
+# brief) via state — used by `make benchmark`. Leave empty for normal
+# engagement work. Restart the LangGraph container after toggling.
+BENCHMARK_MODE=
+
+# --- LangSmith Tracing (optional) ---
+# Set LANGSMITH_TRACING=true to enable. The wizard rewrites both keys
+# when you opt in.
+LANGSMITH_TRACING=false
+LANGSMITH_API_KEY=your-langsmith-key-here
+LANGSMITH_PROJECT=decepticon
+
+# --- Ports (optional) ---
+# Override host-side ports when running multiple Decepticon stacks
+# side by side, or when one of the defaults clashes with another
+# service on your host. Container-internal ports are unchanged.
+# LANGGRAPH_PORT=2024
+# LITELLM_PORT=4000
+# POSTGRES_PORT=5432
+# WEB_PORT=3000
+# TERMINAL_PORT=3003
+# NEO4J_HTTP_PORT=7474
+# NEO4J_BOLT_PORT=7687
+
+# --- C2 Framework ---
+# Default C2 server profile. Change to swap C2 frameworks.
+# Options: c2-sliver (default), c2-havoc (future)
+COMPOSE_PROFILES=c2-sliver
+
+# --- Paths ---
+# Install directory (used for workspace bind mount into containers).
+# - Production: The installer sets this to ~/.decepticon automatically.
+# - Development: `decepticon` (Python entry point) sets this to the repo root automatically.
+# Do not use ~ (tilde) — Docker Compose cannot expand it.
+# DECEPTICON_HOME=/home/youruser/.decepticon
+
+# --- Advanced (optional) ---
+# Disable automatic self-update checks on startup
+# AUTO_UPDATE=false
+# DECEPTICON_DEBUG=true
+
+# Multi-stack container naming (PR #216). Unset/empty keeps the default
+# `decepticon-*` names. Set to e.g. `stack2` to get `decepticon-stack2-*`
+# so two stacks can coexist on the same Docker host. The declaration here
+# (even when blank) silences the compose "variable is not set" WARN.
+DECEPTICON_STACK_NAME=
+
+# --- Language ---
+# Pin agent output language to an ISO 639-1 code. All agent prose output
+# (menus, questions, summaries, errors) renders in this language.
+# Default: en (English). Presets:
+#
+#   en    English           no    Norwegian         da    Danish
+#   sv    Swedish           fi    Finnish           is    Icelandic
+#   ko    Korean            ja    Japanese          zh    Chinese
+#   zh-cn Simplified Chinese                        zh-tw Traditional Chinese
+#   es    Spanish           pt    Portuguese        pt-br Brazilian Portuguese
+#   de    German            fr    French            nl    Dutch
+#   it    Italian           ca    Catalan           el    Greek
+#   pl    Polish            cs    Czech             sk    Slovak
+#   uk    Ukrainian         ro    Romanian          hr    Croatian
+#   bg    Bulgarian         sr    Serbian           sl    Slovenian
+#   hu    Hungarian         ru    Russian           et    Estonian
+#   lv    Latvian           lt    Lithuanian
+#   tr    Turkish           ar    Arabic            fa    Persian
+#   he    Hebrew            hi    Hindi             bn    Bengali
+#   ta    Tamil             te    Telugu            th    Thai
+#   vi    Vietnamese        id    Indonesian        ms    Malay
+#   tl    Filipino          sw    Swahili           af    Afrikaans
+#
+# Country-code aliases (auto-resolved):
+#   dk → Danish    se → Swedish    jp → Japanese    cn → Chinese
+#   br → Brazilian Portuguese      tw → Traditional Chinese
+#
+# Special:
+#   wenyan   文言文 Classical Chinese prose + English technical terms
+DECEPTICON_LANGUAGE=en

decepticon-1.1.0/.git

@@ -0,0 +1 @@
+gitdir: /home/catow/GIT/decepticon_new/.git/worktrees/pypi-strategy

decepticon-1.1.0/.github/CODEOWNERS

@@ -0,0 +1,5 @@
+# Code owners for the Decepticon repository.
+# Every PR to main requires approval from the listed owner(s).
+# Docs: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-security/customizing-your-repository/about-code-owners
+
+* @PurpleCHOIms

decepticon-1.1.0/.github/FUNDING.yml

@@ -0,0 +1 @@
+github: PurpleCHOIms

decepticon-1.1.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,70 @@
+name: Bug Report
+description: Report a bug in Decepticon
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug! Please fill out the sections below.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: A clear description of what the bug is.
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. Run `decepticon ...`
+        2. Start an engagement with ...
+        3. See error ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: What you expected to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+      description: What actually happened. Include error messages or logs if available.
+    validations:
+      required: true
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Version and platform information.
+      placeholder: |
+        - Decepticon version: (run `decepticon --version`)
+        - OS: (e.g., Ubuntu 24.04, macOS 15, Windows 11 + WSL2)
+        - Docker version: (run `docker --version`)
+        - Installation method: (curl installer / git clone)
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Relevant log output (run `decepticon logs` or `make logs`).
+      render: shell
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Any other context, screenshots, or configuration details.

decepticon-1.1.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,53 @@
+name: Feature Request
+description: Suggest a new feature or improvement
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        We appreciate feature suggestions! Please describe what you'd like to see.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: What problem does this feature solve? Is it related to a frustration?
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: Describe the solution you'd like.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: Any alternative solutions or features you've considered.
+
+  - type: dropdown
+    id: area
+    attributes:
+      label: Area
+      description: Which part of Decepticon does this relate to?
+      options:
+        - Agent (recon/exploit/post-exploit)
+        - CLI (terminal UI)
+        - Orchestrator (Decepticon/Ralph loop)
+        - Skills (knowledge base)
+        - Docker / Infrastructure
+        - Installer / Setup
+        - Documentation
+        - Other
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Any other context, mockups, or references.

decepticon-1.1.0/.github/pull_request_template.md

@@ -0,0 +1,21 @@
+## Summary
+
+<!-- Brief description of what this PR does and why. -->
+
+## Changes
+
+<!-- Bullet list of key changes. -->
+
+-
+
+## Testing
+
+<!-- How were these changes tested? -->
+
+- [ ] `make quality` passes (Python + CLI + Web)
+- [ ] `make smoke` succeeds (clean local build + OSS-style up + health checks)
+- [ ] Manual testing (describe below)
+
+## Related Issues
+
+<!-- Link related issues: Fixes #123, Closes #456 -->